CVE-2026-77504

This vulnerability is a weakness in Microsoft Office Word. If someone sends a specially prepared Word document (or otherwise triggers Word processing over the network), it may allow their code to run on your computer instead of just opening the file safely—like slipping a booby-trapped note into a stack of business paperwork.

This matters if your company runs Microsoft Office Word on Windows 10/11 or the listed Windows Server versions. Even if you don’t think you’re a “target,” Word documents are commonly exchanged via email and file sharing, so risk increases wherever untrusted documents can be opened. There is no evidence here that this is actively exploited in the wild (not in CISA KEV), and it is expected to be reachable through the normal ability to trigger Word processing on a machine; exposure depends on whether the affected Office/Word pathway can be reached by an attacker through network-delivered content.

This is RED because it is a remote code execution bug in a widely used application component (Word) with high impact (code can run on the device). While there’s no CISA KEV listing and no public exploit code recorded here, the attacker path is straightforward for phishing/document-based attacks, so you should treat patching as time-critical.